Defence In Depth: What We Practice

We practice what we preach. Zero Trust is part of a complete defence in depth strategy.

Overview

Defence In Depth. The principle is simple. Assume each layer of your security will be breached. Think about how to delay the attacker, how to increase their costs.

The more you can delay the attacker, the more you have a chance of observing and reacting before its too late.

The more you can shift cost from you (the defender) to the attacker, the more likely it is they will go elsewhere.

Defense in depth means defending at each stage of a pipeline. From SAST through simple orthogonal security techniques like fail to ban to zero-trust techniques like splitting identity from authorisation.

Protecting Against the OWASP Top 10 Web Application Vulnerabilities

The OWASP Top 10 is a standard awareness document that outlines the most critical web application security risks and vulnerabilities. Learn how Agilicus AnyX is designed to eliminate an attacker’s visibility into the potential OWASP Top 10 web application vulnerabilities.
570 News Agilicus Interview

Interviewed on 570 News Tech Spotlight. listen to the interview here, I talk through some of the simple risks and how we help. And a bear joke.
Chewy Centre Protected By A Sponge

The M&M is not a good network design: chewy centre, hard shell. Recent cisco router vulnerabilities discussed for defense in depth.
Log4Shell – Not Even the Smart Thermostat is Safe

Ignoring systems that may be deemed ‘unimportant’ in comparison to your revenue-generating technology stack will leave your organization open to compromise from the Log4Shell vulnerability.
A Little Consequences Go A Long Way: Return Of The Bear Joke

Two hikers see a bear. One bends over to tie shoes. Other says, you can’t out run a bear. First says, just need to outrun you. Pause laughter
Fake It Till You Make It: Canadian Bank Multi-Factor Authentication Edition

A big 5 Canadian bank has a fake multi-factor authentication sytem, allowing anyone to fall back to password. Why? How is this acceptable?
The Economic Cost Of Not Having Multi-Factor: MSP Lawsuit Edition

Managed Service Provider Breached. Customer pays out. Who is at fault? Lawsuit to determine. Multi-factor authentication to prevent.
Cyber-Security For Thee But Not For Me

How some public sector entities have great cyber-awareness training, but exempt the elected and senior staff. From Great To Good in one step.
Minimum Viable Secure Product

A simple set of controls for a Minimum Viable Secure Product. Open source for us all to use. Implement, ask in RFP, common baseline to follow
Telnet In Canada: Why?

Telnet. 40 years old, not fit for purpose. Alive and well in Canada. No amount of mitigation or multi-factor authentication makes it OK.
Syniverse Hack, Multi-Factor Authentication, Who Cares? You Should!

This article discusses SMS as a second factor for multi-factor authentication in context with the Syniverse hack.
I AM. I HAVE. I KNOW. Multi-Factor Authentication

I AM. I HAVE. I KNOW. The trifecta of simple and secure. Why does it improve security so much? Because the factors are not correlated. Use at least 2.
Add multi-factor authentication to old applications

Your cyber insurance is up for review. IGet all applications authenticated with multi-factor, simply, quickly, compliantly.
The Pipeline Ransomware Came Via The VPN

A criminal group takes over a nations energy via a VPN. Its time to treat the VPN as a risk, not a security solution. Zero Trust is better.
Zero Day Zero Trust Is Your Defense in Depth

Zero Trust. The principle of limiting access to user resource pairs. It is part of a good defense in depth strategy. It is also a key defense to Zero Day.
3 Simple Steps To Reduce Ransomware Risk

These three simple steps will dramatically reduce your ransomware risk. Achievable, understandable, reasonable.
The strong password, the breach, and the multi-factor save

A strong password breached. Multi-factor authentication saved the day. So many passwords to check. Why can each site not use OpenID Connect single identity?
Quis custodiet ipsos custodes: The Email Scanner Was The Threat

An email security threat scanner, looking for phishiing links, itself becomes the attack vector, from within. Unsubscribed from pardot the beginning.
Angular Content-Security-Policy Complex Nonce: Google Tag Manager

Content-Security-Policy protects our application, but challenging with external scripts like Google Tag Manager. We show in Angular Single Page Application.
Doppelganger Domain Detection

Doppelganger domains are used to spear-phish you. They look similar to ones you use normally. See this new warning in Chrome.
Securely Updating Software: The Update Framework

Secure automatic software delivery without the risk of tampering. The Update Framework in action.
Security.txt: how to document receiving security vulnerabilities

Document how you receive and treat security vulnerability reports with the security.txt standard
Fail to ban. Simple. Strong. Defense in Depth

Fail to ban. Simple. Strong. Make the attackers wait, increase their cost while decreasing your cost of defending. Defense in Depth.
Button down your 2-factor-auth and dnssec lest ye be hijacked

DNSSEC. It helps prevent someone from poisoning a DNS cache or creating a lying recursive. Its simple to enable.
The Agilicus Philosophy: Continuous Learn. Do. Teach.

The Agilicus Philosophy: The world we work in changes. Our requirements change. By continuously learning and adapting, we survive and thrive.
Stupid Simple Security Trick: Add a DNS CAA Record

Want to improve your security for zero cost before you leave for the day? Add a DNS CAA Record. Watch the video to learn more!
The Firewall Emperor Has No Clothes

The Firewall Emperor, long the king of security, has no clothes. Micro segmentation is just more firewalls. You want Zero Trust Network Access.
Software Supply Chain Redux: npmjs shells your hosts

The software supply chain might be the biggest cyber threat out there. Easily accessible open-source, developers under pressure to deliver, complex dependencies. Trouble ensues in npm ecosystem.
Simplify Security: Split Identity and Authorisation with Zero Trust

Zero Trust. The key principle is, we split identity and authorisation apart. We move from a perimeter-based trust (e.g. VPN + firewall) to a user + asset-based model.
Web Application Security 101: Get the basics right

Do what I say. The central tennet of security. In web application security, this translates to a set of headers. Learn how to use Content Security Policy, XSS, CORS, etc.